Additional Configuration

In addition to adjusting configuration properties in Graylog’s primary configuration files, you might need to complete some configuration for additional components of the Graylog stack. Specifically, you need to ensure proper configuration of MongoDB for metadata and configuration data on your clusters and of JVM heap settings for memory management.

Hint: If you are using self-managed OpenSearch as your search backend, you likely need to modify your configuration settings for this application, as well.

This article provides additional detail about each of these components and offers guidance about where and how to set these related configuration properties.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

It is generally required that you are an administrator of the application that requires configuration.
You must have access credentials to third-party components in your environment as necessary.

MongoDB Configuration

MongoDB is responsible for storing metadata and configuration data of the Graylog clusters. You often need to adjust MongoDB properties to allow other Graylog nodes access to the shared database.

For official guidance on adjusting configuration properties for self-managed MongoDB instances, we highly recommend you review the MongoDB documentation.

For use with Graylog, the following situations can require additional configuration for MongoDB:

Ensure that you configure MongoDB for multi-node environments. Both Graylog and Data Node must be configured to connect to MongoDB, and MongoDB must be configured to correctly connect to multiple nodes of Graylog. Specific settings to update are included in our multi-node installation documentation.
Modifications to your MongoDB service can be required for ongoing management of a MongoDB cluster. For instance, adding database machines to an existing cluster requires configuration changes. Consult the MongoDB documentation for details.
If you run MongoDB with authentication, you must configure access control. See the MongoDB documentation for details.

JVM Heap Settings

The Java Virtual Machine (JVM) heap is a memory space that stores objects created by Java applications. The JVM heap is created when the JVM starts and is used by the JVM to allocate objects. Graylog, Data Node, and OpenSearch are Java-based applications. You need to control the amount of memory allocated to each for optimal performance.

It is generally recommended to set JVM heap size to half of your available RAM, but it should not exceed 31 GB. Note that the 31 GB limit is per service, not per computer.

You need to set JVM heap size in the following locations:

Data Node: The Data Node has two JVM heap settings, one for the search backend and one for the service:
- Search Backend: Update the opensearch_heap property in datanode.conf.
  
  Hint: You are directed to update this property during installation. However, if your environment changes, you might need to revisit this setting to maintain peak performance.
- Data Node service: Add or update values in jvm.options, found at /etc/graylog/datanode/. This files is a text file that you can generally open and update directly by adding the minimum and maximum heap size. It is recommended to set both values the same:
  Copy
```
-Xms1g
-Xmx1g
```
  This service needs very little memory and can be set at 1 or 2 GB.
Graylog server: Set the heap value in graylog-server, found at /etc/graylog/. This files is a text file that you can generally open and update directly by adding the minimum and maximum heap size. It is recommended that you set the both values to be the same, so a typical setting might look like:

GRAYLOG_SERVER_JAVA_OPTS="-Xms2g -Xmx2g -server -XX:+UseG1GC -XX:-OmitStackTraceInFastThrow"

Hint: This setting has a default value set initially. Therefore, you should only need to update the -Xms2g and -Xmx2g options to the desired amount of RAM.
OpenSearch: Set the value for OpenSearch in jvm.options, found at /etc/opensearch/.

Warning: You can only set this value directly if you have a self-managed OpenSearch installation. If you are running Data Node, Graylog manages this setting for you, so this file and file path are not available

OpenSearch Configuration

Hint: These configuration settings are only applicable if you are using self-managed OpenSearch as your search backend. Installing Graylog with Data Node is the recommended option and makes ongoing management of the application easier.

The following scenarios with OpenSearch might require additional configuration: